aws-secretsmanager: Secret rotation fails in China if using Postgresql > 13 #28696
Description
Describe the bug
With Postgresql 14+ the password encryption was changed from md5 to scram-sha-256.
The used semantic version from application repository is very, very old and uses a libpq.so.5 version, which does not support scram. Please update to the latest available version: 1.1.212 (aws-cn).
aws-cdk/packages/aws-cdk-lib/aws-secretsmanager/lib/secret-rotation.ts
Lines 161 to 172 in 58b90c4
Expected Behavior
If secret rotation is configured for Postgresql it should also support versions > 13.
Current Behavior
Lambda fails with:
setSecret: Unable to log into database with previous, current, or pending secret of secret arn
After updating the code manually and add more logging we could see:
SCRAM authentication requires libpq version 10 or above
Reproduction Steps
- Create an RDS with postgresql engine version > 13 in China (cn-north-1)
- Setup password rotation
- Rotate the password
Possible Solution
As mentioned above update to 1.1.212 for aws-cn partition. Not sure about aws-us-gov.
Additional Information/Context
CDK CLI Version
2.120.0
Framework Version
No response
Node.js Version
20.11.0
OS
Mac OSX
Language
Java
Language Version
11
Other information
No response